Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Subscribe
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Deep dive Sonar Cloud & integration with Azure DevOps
Rating: 3.9 out of 5(16 ratings)
127 students

Deep dive Sonar Cloud & integration with Azure DevOps

Tools: IAR Compiler, Azure DevOps, Sonar cloud, Programming language is Embedded C, YAML file, Static code analysis
Created byNagarathna T
Last updated 2/2022
English

What you'll learn

  • Introduction to Static code analysis
  • Work flow of Static Code Analysis
  • Introduction to Sonarcloud
  • Deep dive in to Sonar cloud including administration, Quality gates, quality profiles, Pull request Decoration etc
  • Detailed steps to integrate sonar cloud with Azure Pipeline in Embedded domain
  • Sonar cloud integration on Azure DevOps, mainly for embedded C language , IAR compiler
  • IAR Build integration with Sonar cloud configuration steps
  • Challenges faced in this Integrations, Limitations and lessons learnt

Course content

6 sections • 55 lectures • 4h 5m total length

  • Introduction - agenda0:52

    •Static code analysis is a method of debugging by examining source code before a program is run. It’s done by analyzing a set of code against a set (or multiple sets) of coding rules.

    •This type of analysis addresses weaknesses in source code that might lead to vulnerabilities.

    •Static analysis is commonly used to comply with coding guidelines — such as MISRA. And it’s often used for complying with industry standards — such as ISO 26262.

  • What is Static Code Analysis2:40

    •Static code analysis is a method of debugging by examining source code before a program is run. It’s done by analyzing a set of code against a set (or multiple sets) of coding rules.

    •This type of analysis addresses weaknesses in source code that might lead to vulnerabilities.

    •Static analysis is commonly used to comply with coding guidelines — such as MISRA. And it’s often used for complying with industry standards — such as ISO 26262.

  • Things to consider while choosing SCA Tools9:17

    •Sonar cloud/ Sonar qube

    •Perforce Klocwork

    •Codesonar

    •Coverity

    •Fortify etc

  • Why we need SCA Tools2:21
  • SCA tools advantages2:51

Requirements

  • Introduction on SDLC will be good.
  • Introduction to any build tool and a development environment will also helpful to understand course in deeper way
  • No Programming experience needed, will cover in detail about each step required.

Description

In this course, we are going to see how to integrate Sonar cloud analysis tool  in MS Azure pipelines for Embedded C.

To integrate sonar build wrapper is used and a small power shell script written to download this build wrapper.

Creating IAR Compiler batch files for making build  with sonar cloud scanner.

YAML file creation for Build pipeline with detailed sonar cloud configuration steps.

Local Build agent is created and used for build pipelines. (Not a hosted agent)

Understanding and analyzing sonar cloud reports.

How to create a quality profiles?

How to create quality gates?

Walk through on Administration and settings.

Pull request decoration for auto comment in Pull request (in your Build pipeline).

Terminology understanding including code smells, Vulnerabilities , static code analysis (SCA) , build pipeline etc.

Focused more on version controlling of complete CI integration.

Will walkthrough on different SCA tools available and what need to be considered when we choose a SCA tool.

Will discuss on Challenges faced , limitations of these tools  and lessons learnt.

Difference between sonar cloud and sonarqube.

Work flow on the sonar cloud integration with Azure DevOps services.

Shift left testing and SCA advantages.

Will walkthrough on the sonar cloud creating project manually and scanning the project manually.

sonarcloud website walkthrough


Who this course is for:

  • Freshers who wants to learn about sonar cloud integration with Azure DevOps
  • Embedded software developers
  • Application Software developers
  • DevOps Engineers
  • Beginner who are curious about DevOps, Static code analysis tools

Report abuse